diff --git a/examples/cluster-assume-role/README.md b/examples/cluster-assume-role/README.md new file mode 100644 index 0000000..b573677 --- /dev/null +++ b/examples/cluster-assume-role/README.md @@ -0,0 +1,14 @@ +# Enable access to assume the cluster admin role + +1. copy these files into the directory where the group/role is setup + * policies.eks.tf + * variables.eks.tf + * settings.auto.tfvars +1. add the cluster name(s) to the admin_cluster_list (without the eks- prefix) +1. for IAM users, add the policy ARN to the list of polcies +aws_iam_policy.list_assume_policy.arn +1. for SAML roles, add the policy ARN to the list of polcies +aws_iam_policy.list_assume_policy.arn +1. you may need to add a POLICY line to tf-run.data before the ALL if it doesn't exist +1. tf-run plan (starting at POLICY step) +1. commit/PR diff --git a/examples/cluster-assume-role/group.tf b/examples/cluster-assume-role/group.tf deleted file mode 100644 index c62ab90..0000000 --- a/examples/cluster-assume-role/group.tf +++ /dev/null @@ -1,2 +0,0 @@ -# add to user group -# aws_iam_policy.list_assume_policy.arn diff --git a/examples/cluster-assume-role/policies.tf b/examples/cluster-assume-role/policies.eks.tf similarity index 100% rename from examples/cluster-assume-role/policies.tf rename to examples/cluster-assume-role/policies.eks.tf diff --git a/examples/cluster-assume-role/settings.auto.tfvars b/examples/cluster-assume-role/settings.auto.tfvars index 9e533ce..87c1d4f 100644 --- a/examples/cluster-assume-role/settings.auto.tfvars +++ b/examples/cluster-assume-role/settings.auto.tfvars @@ -1,3 +1 @@ -admin_cluster_list = [ - "edl-sa1", -] +admin_cluster_list = [] diff --git a/examples/cluster-assume-role/variables.tf b/examples/cluster-assume-role/variables.eks.tf similarity index 100% rename from examples/cluster-assume-role/variables.tf rename to examples/cluster-assume-role/variables.eks.tf